CRTC proposes requiring ISPs to block malicious botnet traffic

The CRTC has launched a public consultation into whether a network-level framework to block malicious botnet traffic should be developed. In a notice of consultation posted Wednesday, the regulator said botnets, which it classified as a network of malware-infected computers that are under the control of a command and control server operated by a malicious actor, account for an “increasingly large proportion of malware and facilitate the most egregious forms of cyber threats.” On its security centre, anti-virus software developer Norton Antivirus states botnets are another example of “using good technologies for bad intentions,” describing legal botnets as the “workhorses of the internet,” performing a number of repetitive tasks to keep websites operating, most often in connection with Internet Relay Chat. Malicious and illegal botnets however, Norton’s website states, hijack computers to “carry out other nefarious tasks” including spam distribution, assisting in distributed denial-of-service (DDoS) attacks to shut down websites, information theft and deploying pop-up ads designed to get users to pay for the removal of the botnet through a fake anti-spyware package. The CRTC states that ransomware attacks facilitated by malicious botnets are of “particular concern to Canadians” because of the significant service disruptions and financial damage they cause. The regulator states in the notice of consultation that it usually can’t tackle botnet-facilitated attacks at their source as they most often originate outside Canada, but says it has the “authority and mandate” to use regulatory mechanisms to address the activity. Network-level blocking can be implemented through a variety of techniques, with the three most common being domain-based blocking, where infected devices are blocked from accessing blacklisted domains, internet protocol-based blocking, which uses a firewall to prevent communication to the IP addresses of suspected command and control servers, and protocol-based blocking, a more targeted form of IP-based blocking. The regulator states its preliminary view is that network-level blocking is “a viable strategy to prevent the harm botnets cause to Canadians” as well as promoting the policy objectives of the Telecommunications Act. Any framework must include provisions that ensure privacy, allow internet users to opt in or out, correct false positives, ensure blocking decisions are unbiased and made in the best interest of Canadians and minimize the monitoring, collection and usage of subscriber information, the CRTC said. The CRTC states it has endorsed net neutrality in principle, however it has supported limited exceptions including for programs that block access to child exploitation material and for services such as spam filters deployed by telecommunication service providers. A further limited exemption to net neutrality for a network-level botnet blocking framework may be warranted, the CRTC says, because traffic from botnets “exposes Canadians to spam, spyware, information theft and ransomware.” Internet subscribers are asked to provide information about how they would benefit from a potential network-level blocking scheme, as well as any concerns they have about its creation, while internet service providers (ISPs) and stakeholders were asked to respond to a series of questions, including what conditions are needed to safeguard privacy during the monitoring and reporting process of a potential program. Stakeholders and ISPs were also asked whether the program should be opt-in or opt-out,who should decide what content is blocked, how to prevent over-blocking and false positives, which techniques are best to limit botnet communication and how to address future technology changes, noting that botnet design is frequently adapted to bypass known blocking methods. The CRTC also asked which regulatory mechanisms it should use to implement a blocking framework, stating that potential options could include consider simply authorizing carriers to block botnet traffic, imposing a requirement for them to do so, or prohibiting the use of a Canadian carrier’s telecommunication facilities to transmit unsolicited botnet communications. The proposal to create a botnet blocking framework is the second time the CRTC has suggested cracking down on technology used to scam Canadians in the last year, with the regulator asking telecoms for a plan to combat unauthorized phone porting and SIM swapping last January. Interventions on the network-level blocking framework consultation are due by March 15, with replies due April 14. — Reporting by Adam Langenberg at alangenberg@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

CRTC proposes requiring ISPs to block malicious botnet traffic

News | January 14, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CRTC proposes requiring ISPs to block malicious botnet traffic

News | January 14, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Freedom Mobile no longer pursuing full MVNO status

Federal arbitrator releases paid time political broadcast schedule

TV broadcasters denounce streamers’ appeals of CRTC’s broadcasting contribution decision

CRTC considering expanded mandate for Broadcasting Participation Fund

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us